CVE-2026-28279: osctrl Admin RCE Vulnerability

CVE-2026-28279 Overview

CVE-2026-28279 is an OS command injection vulnerability affecting osctrl, an osquery management solution. Prior to version 0.5.0, an authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments in the osctrl-admin interface. These commands are embedded into enrollment one-liner scripts generated using Go's text/template package, which does not perform shell escaping, and execute on every endpoint that enrolls using the compromised environment.

Critical Impact
An attacker with administrator access can achieve remote code execution on every endpoint that enrolls using the compromised environment. Commands execute as root/SYSTEM (the privilege level used for osquery enrollment) before osquery is installed, leaving no agent-level audit trail. This enables backdoor installation, credential exfiltration, and full endpoint compromise.

Affected Products

osctrl versions prior to v0.5.0
osctrl-admin component

Discovery Timeline

2026-02-26 - CVE CVE-2026-28279 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-28279

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. The flaw exists in the osctrl-admin environment configuration module where administrator-supplied hostname parameters are processed without proper sanitization.

The core issue stems from the use of Go's text/template package for generating enrollment scripts. Unlike html/template, the text/template package does not perform any escaping of special characters. When an administrator creates or modifies an environment configuration, the hostname value is directly interpolated into shell scripts that are subsequently executed on endpoints during the enrollment process.

The adjacent network attack vector combined with high required privileges (administrator access) provides some natural barriers to exploitation. However, the changed scope and high impact on confidentiality, integrity, and availability across all enrolled endpoints makes this a significant supply-chain attack vector.

Root Cause

The root cause is the use of Go's text/template package for generating shell enrollment scripts without implementing proper input validation or shell escaping on the hostname parameter. The text/template package is designed for general-purpose text generation and does not sanitize inputs for shell command contexts. When untrusted or semi-trusted data (administrator-provided hostnames) is interpolated directly into shell commands, attackers can break out of the intended context and inject arbitrary commands.

Attack Vector

The attack requires adjacent network access and valid administrator credentials to the osctrl-admin interface. Once authenticated, an attacker can navigate to environment configuration settings and inject malicious shell commands within the hostname field. Common injection payloads might include command separators (;, &&, ||) or command substitution syntax (backticks or $()).

When endpoints subsequently attempt to enroll using the compromised environment, they fetch and execute the poisoned enrollment script. Since enrollment typically runs with elevated privileges (root on Linux/macOS, SYSTEM on Windows) to install osquery, the injected commands inherit these privileges. The execution occurs before osquery installation completes, meaning standard osquery logging and audit trails do not capture the malicious activity.

The vulnerability description indicates that the attack manifests through enrollment one-liner scripts. Administrators with access to the osctrl-admin console can embed shell metacharacters in the hostname field, which are then rendered unsanitized into scripts fetched by enrolling endpoints. For detailed technical information, refer to the GitHub Security Advisory GHSA-rchw-322g-f7rm.

Detection Methods for CVE-2026-28279

Indicators of Compromise

Unusual or suspicious strings in environment hostname configurations containing shell metacharacters (;, &&, ||, $(), backticks)
Modified enrollment scripts containing unexpected commands or payloads
Endpoints exhibiting unusual behavior immediately following osquery enrollment
Network connections to unknown external hosts during the enrollment process

Detection Strategies

Audit osctrl-admin configuration changes, specifically focusing on environment hostname modifications
Review enrollment script templates for any injected commands or suspicious syntax
Monitor osctrl-admin access logs for administrator sessions making environment configuration changes
Implement file integrity monitoring on enrollment script generation paths

Monitoring Recommendations

Enable comprehensive logging for all osctrl-admin administrative actions
Configure alerts for environment configuration changes, particularly hostname modifications
Monitor endpoint enrollment processes for execution of unexpected commands
Establish baseline behavior for enrollment scripts and alert on deviations

How to Mitigate CVE-2026-28279

Immediate Actions Required

Upgrade osctrl to version v0.5.0 or later immediately
Audit all existing environment configurations for suspicious hostname values containing shell metacharacters
Review administrator access logs for unauthorized or suspicious configuration changes
Restrict osctrl-admin access to verified, trusted personnel only

Patch Information

The vulnerability is fixed in osctrl v0.5.0. The fix was implemented through GitHub Pull Request #777 and GitHub Pull Request #780. Organizations should update to version v0.5.0 or later to remediate this vulnerability. The security advisory with full details is available at the GitHub Security Advisory GHSA-rchw-322g-f7rm.

Workarounds

Restrict osctrl administrator access to trusted personnel only and implement strong authentication controls
Review all existing environment configurations for suspicious hostnames containing shell metacharacters or command syntax
Monitor enrollment scripts for unexpected commands before deploying to endpoints
Implement network segmentation to limit the blast radius of potentially compromised enrollment scripts

bash

# Review environment configurations for suspicious hostnames
# Look for shell metacharacters in hostname fields
grep -E "[;\|\$\`&]" /path/to/osctrl/configs/*

# Audit administrator access (example log review)
grep -i "environment" /var/log/osctrl/admin.log | grep -i "hostname"